# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 29 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 401696 — https://publicmosaic.com/asn/401696
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 103.73.162.97 14145 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103634; rev:2;)
alert tcp $HOME_NET any -> 103.97.177.92 10089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102549; rev:2;)
alert tcp $HOME_NET any -> 103.149.93.150 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104597; rev:2;)
alert tls $HOME_NET any -> 103.185.249.13 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"c03152b51899d568c8c90cffb8a31c46e8a5f710e85a4eae9c51647dcd47a045"; reference:url,publicmosaic.com/indicators; sid:9100534; rev:2;)
alert tls $HOME_NET any -> 103.185.249.13 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"270975a12075bdc98d4509af067855203e4b2b5f5627963e96c63b2ac080765e"; reference:url,publicmosaic.com/indicators; sid:9100358; rev:2;)
alert tls $HOME_NET any -> 103.242.12.143 80 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0c94f1104f673f3d049bc6e2a507e601a063234a7c1c6ff7fc3ec4bb9660c5b2"; reference:url,publicmosaic.com/indicators; sid:9100761; rev:2;)
alert tcp $HOME_NET any -> 103.242.12.143 1234 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101218; rev:2;)
alert tls $HOME_NET any -> 154.12.80.232 8888 (msg:"HOLLOWPOINT C2 darksword"; tls.cert_fingerprint; content:"5b53d54fa21a7dfe8670d037145a8c453fc0635a473b791af8897d1931b803b9"; reference:url,publicmosaic.com/indicators; sid:9105968; rev:2;)
alert tls $HOME_NET any -> 154.12.83.111 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"50649097eff277ccf62b7bb06f7e442426436ab9dbd405d8060f71d70a9e30bb"; reference:url,publicmosaic.com/indicators; sid:9103915; rev:2;)
alert tcp $HOME_NET any -> 154.12.90.160 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101798; rev:2;)
alert tls $HOME_NET any -> 154.12.90.160 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"db17e1bfd02de4c089a66cd85a7dac5a42ad0e6d1a56744011b676185fc9d30c"; reference:url,publicmosaic.com/indicators; sid:9103914; rev:2;)
alert tls $HOME_NET any -> 154.12.90.231 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a927566bf9c09ac8e2761f5cbaa4ea8a662f28393f879bcba6c028c4c5beaa4c"; reference:url,publicmosaic.com/indicators; sid:9100175; rev:2;)
alert tcp $HOME_NET any -> 154.12.92.28 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102342; rev:2;)
alert tls $HOME_NET any -> 154.201.68.199 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d06656f0b1ce1ab971bc949ad667e27ed0c3e458b242dcabd6f95566abbdb9e7"; reference:url,publicmosaic.com/indicators; sid:9101793; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101233; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101229; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101224; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101222; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101231; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101227; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101223; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101226; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101225; rev:2;)
alert tcp $HOME_NET any -> 156.225.18.45 33333 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100103; rev:2;)
alert tls $HOME_NET any -> 156.225.18.45 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"44d5c678203a9049263523d1ee53db834cba5e23e8a7fbc0376b1bf0b53ad682"; reference:url,publicmosaic.com/indicators; sid:9105188; rev:2;)
alert tls $HOME_NET any -> 156.225.18.58 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9101792; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102723; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102722; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102721; rev:2;)